## What changed
- Add `gpt-6.1-terra` to the bundled catalog and GCP Vertex model picker.
- Add `openai.gpt-6.1-terra` to Amazon Bedrock catalogs, including Global and US cross-region runtime variants.
- Use `gpt-6.1-terra` as GCP's preferred memory consolidation model.
## Testing
Extend catalog, model picker, thread startup, and Vertex request tests to cover GPT-6.1 Terra.
GitOrigin-RevId: edb3be3c4286c191349cdee742005ed3c67029e8
## Why
Async question replies appeared as plain user text, leaving Markdown formatting literal and repeating the full question above each answer.
## What changed
- Accent question titles with a `?` prefix while preserving Markdown in titles and suggestions.
- Render replies with a `↪ Re:` question caption and a Markdown answer. Limit captions to two rows with an ellipsis on overflow, while keeping answers complete.
- Apply the same rendering to live messages and loaded transcripts, preserving inline styles, hyperlinks, and Markdown when copying selections.
## Testing
Add snapshots and assertions for matching live and loaded transcript rendering, plus tests for caption clipping, hyperlink bounds, Markdown copying, partial selections, and whitespace-only or nonprinting answers.
GitOrigin-RevId: 0290d8a2ebfb42bd5d7374c7037cde5ae8a13b5d
## What changed
Replace `UserHistoryCell`'s `spoken` boolean with `UserMessagePresentation`, defaulting to `Plain` and using `Spoken` for speech transcripts. Route rendering checks through `is_spoken()`, preserving the existing prompt styling and whitespace handling.
GitOrigin-RevId: d0683a2b536a7d71f68fd9a089e6839d0ab0cc65
## What changed
- Add `codex-plugin-host` to launch a helper with a cleared environment, verify its readiness handshake, and expose framed stdin/stdout pipes with a 256 KiB frame limit and write backpressure.
- Support startup cancellation and process-group cleanup, retaining exit status and the last 16 KiB of stderr while omitting raw diagnostics from `Debug` output.
- Extend the Bazel crate macro to support test-only binaries and fixture entry points outside `src/`.
## Testing
Add process integration tests for framed communication, startup cancellation, helper and descendant cleanup, repeated close calls, and bounded diagnostics from startup and runtime failures.
GitOrigin-RevId: ed539e7899af06ee83a0d8c2d0ea8cec10f19afb
## What changed
Keep inherited incremental tool declarations in MCP-disabled prediction forks and `thread/sample` requests, and append a developer notice that MCP tools are unavailable. Skip tool declaration updates within the inherited context window; new windows still declare the current tools.
Add the default-enabled `prediction_preserve_parent_tools` feature flag and its configuration schema entries.
## Testing
Update core snapshots and app-server tests to cover inherited declarations, the MCP-unavailable notice, preservation across MCP refresh, and continued parent tool availability.
GitOrigin-RevId: 3adf96c7d0e0093986dbdbd540bd47674a2c105c
## What changed
Accept `[network_proxy]` in `requirements.toml`, retaining `[experimental_network]` as a compatibility alias. Reject both names in a single layer and normalize them before merging across layers so precedence and source tracking are preserved.
Honor the new spelling during credential broker project discovery, display `network_proxy` in debug configuration, and update diagnostics and documentation. Document the distinction between managed requirements, proxy feature configuration, and permission profiles. Policy publishers must keep using `[experimental_network]` until all clients and policy validation layers support the new spelling.
## Testing
Add coverage for alias equivalence, duplicate rejection, cross-layer precedence and sources, and broker project discovery. Exercise both spellings in proxy configuration, network approval routing, app-server requirements responses, and Windows machine policy validation.
GitOrigin-RevId: 5c5bb82bd4b6b1431aa97f27248775820eae6302
## Why
Mouse capture prevents the terminal from handling link-opening gestures in expanded questions.
## What changed
Disable mouse capture while questions are expanded and the TUI owns the screen, unless an interactive modal is active. Restore the default capture policy when questions collapse.
## Testing
Add a regression test covering expansion, collapse, non-owned screens, and link visibility with warnings open.
GitOrigin-RevId: 1fd37feb5c9cd374b492218eeef8c80316bb1cf9
## What changed
Replace screen-specific `OverlayInput` variants with `MouseCapture::{Inherit, Enabled, Disabled}` and rename the setter to `set_mouse_capture`.
Preserve existing capture behavior: transcript and usage overlays enable capture, onboarding and static pagers disable it, and the inherited policy follows screen ownership. Update the alternate-screen and lifecycle tests to use the new policy.
GitOrigin-RevId: 965a3bb6d0854e289d2b0dbeedbf2b252b98293d
Compact token counts can round to `1000K`, `1000M`, or `1000B` near unit boundaries. Promote these values to the next suffix so, for example, `999,500` tokens displays as `1M` instead of `1000K`.
GitOrigin-RevId: 803e7c8c8eebd61522fb717275b43904a5da056f
## Why
Remote App Server sessions support the command center, but the empty-prompt Left shortcut and its footer hint were enabled only for local daemon sessions.
## What changed
Enable the shortcut and `← for agents` hint for remote sessions. Centralize command center availability in `AppServerTarget::supports_command_center()` and use it consistently across navigation, lifecycle handling, trust prompts, and command center actions. Embedded sessions keep command center support disabled.
## Testing
Extend navigation coverage to verify the footer hint and opening the agents overview for both local daemon and remote sessions, while keeping navigation disabled for embedded sessions. Add a remote-session footer snapshot and update related UI tests to use the shared capability flag.
GitOrigin-RevId: 8148812217f68cf0fd441c35ed3c5b466ecc9cbd
## Why
MCP completion events can truncate large results and omit content removed for model consumption. Rollout traces need the original response, including content and metadata, as well as results for calls denied before reaching the backend.
## What changed
- Record MCP runtime results before callbacks, content filtering, and UI truncation, and record skipped calls as failures.
- Stop deriving MCP runtime completion records from protocol events to avoid duplicate records.
- Treat MCP runtime payloads as opaque results when reducing agent interactions.
- Buffer JSON trace writes and explicitly flush them.
## Testing
Extend app-server tests to verify that traces retain oversized MCP text, audio, structured content, and metadata while UI results remain truncated, and that denied calls produce exactly one failed runtime result with the denial reason.
GitOrigin-RevId: 57880770545eb5869420d7dc6fa4a15e481cae9d
## What changed
When `features.untrusted_as_tool_output` is enabled, emit untrusted additional context as `function_call_output` items in the `agent` namespace before user input. Use the explicit context name when supplied; otherwise derive a bounded name from the source key, falling back to `untrusted_content`.
Deduplicate these outputs by name and truncated value so name changes are emitted while changes confined to truncated content are ignored. Application context remains in developer messages, and disabling the feature preserves the existing message format.
## Testing
Extend core and app-server tests and add request-history snapshots covering both formats, turn start and steering, derived names, truncation, and deduplication.
GitOrigin-RevId: cd5e2f4b3121714acb7f4baf5607f3c27d408cae
## What changed
- Separate native child spawn preparation from submission and move forked-history loading and filtering into `agent::history`.
- Group resolved session startup dependencies in `ThreadStartupContext` and extract helpers for effective spawn configuration and inherited environment requests.
- Share loaded-recipient message submission and capture only the content needed for communication logging, avoiding a clone of the full message.
GitOrigin-RevId: 4417ba6ca35e9f293064600f0a54932de514636f
## What changed
Remove the `i18n-config` Git patch and its `cargo-deny` Git source allowance. Update the Cargo and Bazel lockfiles to use the crates.io release of `i18n-config` `0.4.8`, restoring its `basic-toml` dependency and adjusting the locked TOML dependencies.
GitOrigin-RevId: 4d4f6c52dddf79d2006e170432347ab79280da51
## What changed
Add `WorldStateSectionContribution::with_window_prefix()` to render extension developer fragments as separate messages before retained history when building a context window, including after compaction. Updates within an existing window still append to history. Ignore fragments with other roles for sections that opt in.
## Testing
Add a unit test for prefix placement and duplicate avoidance, plus local and remote compaction scenarios covering live updates, persisted replacement history, and rejection of non-developer fragments.
GitOrigin-RevId: 8621457c6eec17f1585ca8e6fa154b1bf3257330
## Why
Image generation usage-limit errors with the `imagegen_premium` limit ID were not recognized as structured `UsageLimitExceeded` failures.
## What changed
Recognize `imagegen_premium` alongside `image_gen`, preserving the limit ID and available reset time in image generation failure metadata.
## Testing
Extend app-server coverage to verify premium limit metadata and reset-time fallback in completion events, thread reads, and resumed threads. Add unit coverage for missing exhausted-window reset times and unrelated or absent limit IDs.
GitOrigin-RevId: 8cf991776403ddce1f45d9780b8040982fd0fcfe
## What changed
Collect REPL evidence as shared immutable response records, then select and render it during synchronous context preparation. Share response selection logic between text and multimodal layouts while preserving rendering limits, omission markers, and image order.
Use the shared `NodeReplResponse` type in core evidence storage and preserve existing snapshots through copy-on-write image eviction.
## Testing
Extend tests to verify shared response identity during collection, unchanged rendering after preparation, and snapshot stability when storage pressure evicts images.
GitOrigin-RevId: 8564d3732faa5adf01a66bca523d4c03cfbe1822
## What changed
- Validate inherited options before and after the `queue` subcommand, with explicit errors for unsupported flags and positional prompts.
- Reject `--model` and `-c model=...` because queued messages use the thread's model.
- Allow `--cd` for local server startup, but reject it with `--remote`.
- Hide unsupported inherited options from queue help and clarify the scope of startup configuration overrides.
## Testing
Add regression coverage for unsupported options in both argument scopes, model configuration overrides, remote `--cd` conflicts, and queue help output. Preserve coverage for overrides that bypass a running local daemon.
GitOrigin-RevId: 703ba26f38930a01559847e66e1af3d0d338d1e9
## What changed
Add session options for client- or server-owned output truncation and optional `max_output_tokens` budgets for wait and terminate observations. Introduce `TerminateRequest` and update session implementations and callers to use it.
Extend the stdio and gRPC schemas with optional truncation settings and budgets, and define the `bounded-output-v1` capability. Existing sessions retain client-side truncation; providers reject server mode by default. This change defines the contracts without enabling server-side truncation.
## Testing
Extend protocol serialization coverage for `outputTruncation: "server"` while preserving existing wire shapes when optional fields are absent.
GitOrigin-RevId: 22145897ea16d385c5ba9e7549109f7a669fceb4
## What changed
- Allow selecting warning text while preserving wrapped URLs and hard line breaks when copying.
- Add mouse-wheel scrolling within the warning body and keep page navigation working after selection.
- Use the shared menu surface and show configured scroll hints only for directions with more content.
- Preserve painted backgrounds when rendering text selections.
## Testing
Add coverage for warning selection without changing the draft, paging after selection, wheel scrolling and directional hints, and selection boundaries in scrolled text containing tabs and wrapped words. Update warning panel snapshots.
GitOrigin-RevId: c4b77277a60b7b4af92043cb3761769ddc636454
## Why
Sandbox invocations without an explicit permissions profile and remote `exec-server` connections using ChatGPT auth need access to cloud-defined model providers and managed requirements. Cloud bootstrap requests must also respect local application network policy.
## What changed
- Bootstrap sandbox cloud config whenever managed config is included, even without an explicit profile. Skip bootstrap when `--sandbox-state-json` supplies the sandbox state.
- Load cloud config for remote executors beyond workload identity, while skipping forwarders and executors using stdin credentials, AWS SigV4, or agent identity auth. Honor `CODEX_API_KEY` selection so API key connections skip ChatGPT cloud config.
- Apply local application network policy during cloud bootstrap and activate effective application network policy before exec-server clients are created.
## Testing
Add coverage for cloud-defined providers in sandbox and remote exec-server invocations, API key bypass, local policy blocking bundle requests, cloud policy blocking remote registration, and bootstrap exclusions.
GitOrigin-RevId: e8bd6210751e96161f575ade309ebf41bf10f8b5
## Why
The Bazel V8 source build supported Windows GNU but lacked an MSVC-targeting toolchain to produce `*-pc-windows-msvc` archives.
## What changed
- Add opt-in archive targets for native Windows x64 and ARM64 hosts, selected by `//third_party/v8:rusty_v8_native_windows_archive_for_target`.
- Fetch pinned LLVM and scope its `clang-cl` toolchain to V8 artifacts, using the installed Microsoft SDK. Bundle Chromium libc++ and compiler-rt builtins into the resulting `.lib`.
- Adapt V8 dependencies, assembly, snapshot generation, and platform feature settings for MSVC, and derive test metadata from the selected engine features.
- Document the native build workflow. Existing MSVC consumers continue using prebuilt artifacts; generated Rust bindings and publishing integration remain separate.
GitOrigin-RevId: abd5049245aece90a116fc3bfeac2b158a76f6af
## What changed
Emit `codex.tui.embedded_start` when the TUI successfully connects to an embedded app server, with a `reason` tag identifying daemon exclusions, disabled auto-start, failed daemon connections, or agent startup without a discovered daemon.
Distinguish `--search` from other configuration overrides when it is the only configuration exclusion preventing daemon use.
GitOrigin-RevId: b837ad2e83af17ea92392ffa6d5f91108ceaeecc
## Why
Cloud conversations own their execution settings and workspace. TUI requests must preserve those settings instead of overriding them with local configuration.
## What changed
- Add a distinct cloud parameter mode that omits local execution settings from thread start, resume, and turn requests, including misalignment continuations.
- Route cloud model and reasoning selections through `thread/settings/update`, requiring server acceptance rather than falling back to local changes or saved defaults.
- Use server model defaults and tolerate an unavailable `configRequirements/read` method during cloud bootstrap.
- Skip local tool setup and TUI-generated titles, and report that permission selection, forking, and conversation recaps are unavailable for cloud conversations.
## Testing
Add regression coverage for cloud request parameters, bootstrap without configuration requirements, rejected model changes, and suppression of unsupported requests.
GitOrigin-RevId: a2dafb6c8a6b0db8607575e2291fee739c2fb2b1
## What changed
- Make the `fast-mode` status line and terminal title items show the current model's processing tier name, falling back to `Standard`, instead of `Fast on` or `Fast off`.
- Share tier label resolution with `model-with-reasoning`, including `Flex` for configured providers other than Amazon Bedrock, and remove the ChatGPT account requirement for displaying tier names.
- Refresh model-dependent surfaces when Fast or Ultrafast mode is enabled or disabled.
## Testing
Update status surface tests and snapshots to cover tier selection, feature toggles, model changes, and provider-specific `Flex` fallback behavior.
GitOrigin-RevId: 7d67ae6177bb1b3c0be4ecf0910106aaaf2bd0be
## What changed
- Add optional `omitted_paths` and `denied_reads` fields to catalog permission messages. The latter requires exactly one `{{ denied_reads }}` placeholder.
- Preserve mandatory denial and no-bypass warnings, path/glob facts, and existing path selection limits. Limit each override to 500 UTF-8 bytes and fall back independently to bundled wording for invalid overrides.
- Pin `i18n-config` to an upstream revision that removes the unmaintained `basic-toml` dependency, updating Cargo and Bazel lockfiles.
## Testing
Add serialization and rendering coverage for sparse values, invalid templates, byte limits, and preserved policy facts. Extend model-switch scenarios to verify that warning wording follows the selected model while preserving request history and permission annotations.
GitOrigin-RevId: f5fa1a978abe07d90917f552c64e7c8fc257c061
## What changed
- Add the disabled-by-default `skill_catalog_deltas` feature flag to append new and updated skills without repeating unchanged catalog entries.
- Share a cumulative metadata budget across executor, cloud, and host catalogs, preserving usage across turns and resume. Removals emit no update and do not refund budget.
- Rebuild the current catalog and reset its budget after compaction, including any required skill root mappings in updates.
## Testing
Add unit and integration coverage for update costs, shared source budgets, feature rollback, and catalog updates across resume and compaction, with a request-history snapshot.
GitOrigin-RevId: e88b4265d7361498113d43fdc2e0260a9f930bbc
## What changed
Extract patch parsing, verification, and permission assessment into request preparation helpers used by the tool handler and intercepted shell patches. Execute the prepared `ApplyPatchRequest` through the existing runtime and derive auto-approval status from its approval requirement.
Move approval action construction onto `ApplyPatchRequest` and update the existing approval tests to use the new helpers.
GitOrigin-RevId: 7f07d38f0dbf2a971c94b897281651b7a174fd05
## What changed
Introduce `PreparedPermissionRequest` to encapsulate argument parsing, path resolution, permission normalization, and approval action construction. Pass the prepared request, including the selected environment ID, into session permission handling.
## Testing
Extend the selected-environment path resolution test to assert that the prepared approval action carries the expected environment, reason, and resolved permissions, matching the emitted permission request.
GitOrigin-RevId: ebd34fad0e5d4c9f98330d17a6254325526b8c78
## Why
Async question titles support Markdown, but named choices display Markdown syntax as plain text.
## What changed
Render named choices with Markdown styling and terminal hyperlinks, wrapping them to the available width after the numbered prefix. Use the rendered rows for height measurement and scrolling, and reuse layout measurements for the option tip.
Share viewport-aware Markdown rendering between question titles and choices, preserving hyperlink destinations when splitting overwide tokens.
## Testing
Extend tests to cover Markdown-aware height measurement, italic styling, and terminal hyperlinks in selected choices. Update the long-choice snapshot to show text starting beside its numbered prefix.
GitOrigin-RevId: 7a1292ac7dff16b55439888d569fc7fa7c6ef689
## Why
Cache presence and freshness checks deserialize full plugin records even when callers only need to decide whether a cached catalog is available.
## What changed
- Probe cache availability without deserializing plugin records, while still requiring a valid catalog envelope and a `plugins` array.
- Let `PreferFreshCache` reject stale catalogs from a 256-byte prefix when the header provides enough information; fall back to a full read otherwise.
- Limit discovery cache probes to the user and workspace scopes that need them, skipping the global cache probe.
- Serialize cached plugin slices directly without cloning them.
## Testing
Add coverage for malformed cache headers and payloads, reordered fields, stale-prefix rejection, and deferring plugin-record validation until a full catalog load.
GitOrigin-RevId: 1e5ec95917f38c84bba30dbd3bb8c2f91cc7e3a8
## Why
Tool suggestions loaded and cloned the cached connector directory even when no candidates remained after excluding accessible apps.
## What changed
- Filter out accessible connectors before loading the directory, skipping the lookup when no candidates remain.
- Share cached directory entries through `Arc<[AppInfo]>` and clone only matching entries for suggestions.
- Preserve placeholder suggestions for candidate connectors missing from the directory.
## Testing
Add coverage for skipping directory lookups with no remaining candidates, sharing cached storage, and preserving directory metadata and missing-connector fallbacks while excluding accessible apps, including disabled ones.
GitOrigin-RevId: acaf3e1564fb4e2b4f805cffe1d7db8e40d5fe3d
## Why
Attached threads need inherited context for model requests while exposing only their own turns to clients. Parent turns and token usage should not appear as activity in an empty attached thread.
## What changed
- Stop attached-thread history traversal at the parent boundary, including after reverts, and hide inherited interruption markers.
- Apply visible-history boundaries to search, realtime timelines, and turn-specific fork and revert requests.
- Suppress inherited token-usage replay on paginated fork resumes, require fork replay to reference a returned turn, and skip empty turn IDs.
- Require a paginated source for `thread/fork` with `attachToSource` and update the protocol documentation.
## Testing
Extend regression coverage for attached-thread restart and database recovery, retained parent context in model requests, child-only history, mid-turn fork boundaries, legacy-source rejection, and suppression of parent token-usage notifications.
GitOrigin-RevId: 67858caf3bb74b7e79d4dd59bed9c61055fe0ff1
## What changed
Add four advisory exceptions to `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml`, documenting the usage constraints and removal criteria:
- `RUSTSEC-2026-0391`: borrowed contexts are not reused across streams; remove after upgrading to `zstd >=0.14.3` on all paths.
- `RUSTSEC-2026-0398`: the affected seekable feature is disabled; remove after upgrading to `zstd-safe >=8.2.0` on all paths.
- `RUSTSEC-2026-0403`: callers use read decoders or initialized output buffers and discard output on error; remove after upgrading to `zstd-safe >=8.2.0` on all paths.
- `RUSTSEC-2026-0410`: the allocator bug affects `wasm32`, while Codex ships native binaries; remove when the lockfile uses `zstd-sys >=2.1.2`.
GitOrigin-RevId: 556e53be961b01191590e2ca4e9f08dd9f017eac
## Why
On Linux, a cold start from a rotational disk can exceed the ten-second readiness timeout. Extending that timeout should still let startup failures surface promptly when the daemon exits.
## What changed
- Increase the Linux readiness timeout to 30 seconds, matching macOS.
- Stop waiting for readiness when the published daemon process exits, preserving the PID reservation and reporting startup diagnostics, including stderr.
- Kill pending `ps` subprocesses when their process checks are dropped.
## Testing
Add coverage for a managed daemon becoming ready after 15 seconds and for reporting an exited daemon's stderr within five seconds.
GitOrigin-RevId: c663e52bea9039807f14ef8fc4b44aca9df3df21
## Why
ENT26 plans are billed directly in dollars, so credit estimates and credit-weighted breakdowns do not describe their thread usage.
## What changed
- Expose optional `nativeUsageUsdMicros` in app-server `ThreadUsage` responses and generated schemas and SDK types. Missing native usage means unknown, not zero.
- Enable ENT26 usage fetching and display native dollar amounts in `/status`, the status line, terminal titles, and the agents overview. Hide credits and omit credit-weighted `/status` breakdowns for these plans.
- Use native dollar amounts when tracking post-turn usage settlement for ENT26 plans.
## Testing
Add coverage for native usage forwarding, ENT26 billing displays, and settlement polling with stale, missing, or zero dollar amounts.
GitOrigin-RevId: ca8ea98141a66bdf0a27feb9f58f67822b821f5f
## Why
Hosts that only need installed plugin inventory should be able to skip startup requests for plugin discovery.
## What changed
Add the stable, default-enabled `features.plugin_discovery_prefetch` flag. Setting it to `false` skips startup prefetching of the plugin directory, featured plugins, and recommendations while preserving installed plugin cache refreshes and bundle downloads.
## Testing
Update app-server integration coverage to verify that installed plugin bundles download with discovery prefetch disabled and that no directory, featured, or suggested plugin requests are made during startup. Also cover listing remote marketplaces with the flag disabled.
GitOrigin-RevId: 7cc3072f6045131b9f1acb851f6240db75ac173e
## Why
The same-owner token-refresh tests need the original backend response to remain pending until `getAuthStatus` publishes refreshed credentials. A fixed response delay does not guarantee that ordering.
## What changed
Gate responses in the `getAuthStatus` test cases until a request-specific auth reload log confirms the credential change. Emit that log after updating the cached auth and generation, and include `auth_changed_for_refresh` as a structured field.
Extend the JSON log test helper to match events with predicates, allowing tests to identify the refresh by its request span.
GitOrigin-RevId: 698f3be499ea3c035f082c501836dae4178adaef
## Why
A duplicated or inherited file handle can keep the rollout maintenance lock held after its guard is dropped, blocking subsequent compression or migration.
## What changed
Explicitly unlock the file in `RolloutMaintenanceGuard::drop` so lock ownership ends with the guard even if another handle remains open.
## Testing
Add a regression test that retains a duplicated file handle, verifies that the lock stays held until the last shared guard is dropped, and checks that dropping the old handle does not release a newly acquired lock.
GitOrigin-RevId: 19005680dbc0a01b36c6f13e4ec358c6f00b75a0
## Why
Each turn runs an external hook, making a shared ten-second deadline too restrictive. Turn completion can also precede deletion of the queued item.
## What changed
Use the event waits' progress deadlines in the rejected-message test and wait for the queue to empty before checking results, replacing the immediate empty-queue assertion.
GitOrigin-RevId: 2b417840156893d829dc2984aa88b06a5a13aefe
Replace the fixed 200 ms sleep in
`reusing_completed_process_returns_unknown_process` with polling until
`write_stdin` reports no process ID, bounded by a 10-second timeout. This
ensures the shell has completed before asserting that reusing its process
ID returns `UnknownProcessId`.
GitOrigin-RevId: c752e9c2c0a419fa5a06ba957bee49dcaeb5d6d2
Run the deferred paste newline and standalone Enter handoff tests with
`start_paused = true` so their timing uses Tokio's paused clock.
GitOrigin-RevId: d903c0e1078b81531912e54819499b0c3a0fb307
## What changed
Change the default `thread_unload_delay_secs` from 1800 to 60 seconds. App-server threads become eligible for unloading after one minute with no subscribers and no activity. Update the configuration documentation, schema, and thread manager sample to match.
## Testing
Update the configuration test to cover the 60-second default, zero for immediate unloading, and an explicit 1800-second override.
GitOrigin-RevId: 0da8454eb25a6ef4b7e3665601982d2e0c183f7c
Remove the hard-coded 9,000-token cap for encrypted agent messages in both synchronous and asynchronous guardian context. Use `message_tokens` directly when converting the configured limit to a byte budget, allowing larger messages when the configured limit permits them.
Messages that exceed the configured budget still produce an omission notice; encrypted content remains intact when retained.
GitOrigin-RevId: a9032ca19102ebad44be8df1ac4d4892d4404ead
## Why
Memory baseline snapshots need bounded file reads, and recovery must keep existing memory files visible to consolidation rather than treating them as already processed.
## What changed
- Limit baseline files to 10 MiB, skip oversized working files, and check stored blob sizes before reading them.
- Version baselines and replace missing, outdated, or unusable metadata with an empty baseline, preserving working files as additions. Also invalidate the baseline when a tracked file grows beyond the limit.
- Serialize baseline initialization, resets, and diffs with a cross-process lock. Isolate repository access and pin index writes to the baseline worktree.
## Testing
Add coverage for oversized files, legacy baseline migration, interrupted resets, cross-process locking, and consolidation with unchanged inputs after baseline recovery.
GitOrigin-RevId: 34ecc9e5700a88ed37eff83a90f08d8a9b0d9f29
## Why
The timeout fallback test depends on short wall-clock deadlines and a server-side sleep, making its timing dependent on thread scheduling.
## What changed
Use a paused Tokio clock and advance past the timeout only after the server receives `HEAD`. Keep the blocking server task alive until the probe consumes the `GET` response to prevent automatic clock advancement during socket I/O.
Assert both request lines and retain the check that the fallback returns `HTTP 405`.
GitOrigin-RevId: da7b2fa9c67e662648da8568ce7f8cfde153dc12
## Why
The context inheritance tests enabled `MultiAgentV2` but invoked `spawn_agent` through the V1 namespace, leaving the V2 path untested.
## What changed
- Share a helper that spawns through the V2 namespace, waits for child completion, and identifies the child's request by its thread ID.
- Assert that the child receives inherited instructions in a `developer` message and its task in an `agent_message` addressed to `/root/worker`.
- Test skill instructions both enabled and disabled for parent and child requests, with an explicit skills extension and discovery isolated to the fixture skill.
GitOrigin-RevId: 193fca57398e950acad1f020382dc1bae6453df4
## Why
Commands that fall back without using a shell snapshot should remain associated with their configured snapshot mode in telemetry.
## What changed
Add a `shell_snapshot_mode` telemetry tag to `exec_command` with values `disabled`, `v1`, or `v2`. Give `v2` precedence when enabled. The tag records configuration, not whether a command actually used a snapshot.
## Testing
Add parameterized coverage for all four combinations of snapshot feature flags using a non-login command, which cannot use V2 snapshots.
GitOrigin-RevId: 2dd9e79b9e02448938166254ea1b988034a81b5e
## Why
The fixture token `new` can appear in randomly generated Base64 public keys, causing the executor registration response's credential check to reject valid test responses.
## What changed
Use hyphenated fixture tokens that cannot occur in Base64 keys. Set the retry test's X25519 public key to a value containing `new` so the former collision is exercised deterministically.
GitOrigin-RevId: 059043eddc388a69c4659d6cdcac6ee107ae1973
## Why
Some I/O errors can repeat without advancing the dotenv iterator, causing environment loading to loop indefinitely.
## What changed
- Only open the Codex home `.env` path when it is a file.
- Stop processing entries on I/O errors other than `InvalidData`, while continuing past invalid UTF-8 lines and parse errors.
GitOrigin-RevId: 4b79b5e87b6924b342265e0688ebe59fefea4637
BOZHANG-OAI